distant_net/common/transport/framed/
exchange.rs

1use std::convert::TryFrom;
2use std::io;
3
4use p256::ecdh::EphemeralSecret;
5use p256::PublicKey;
6use rand::rngs::OsRng;
7use sha2::Sha256;
8
9use crate::common::SecretKey32;
10
11mod pkb;
12pub use pkb::PublicKeyBytes;
13
14mod salt;
15pub use salt::Salt;
16
17/// Utility to support performing an exchange of public keys and salts in order to derive a shared
18/// key between two separate entities
19pub struct KeyExchange {
20    secret: EphemeralSecret,
21    salt: Salt,
22}
23
24impl Default for KeyExchange {
25    // Create a new handshake instance with a secret and salt
26    fn default() -> Self {
27        let secret = EphemeralSecret::random(&mut OsRng);
28        let salt = Salt::random();
29
30        Self { secret, salt }
31    }
32}
33
34impl KeyExchange {
35    // Return encoded bytes of public key
36    pub fn pk_bytes(&self) -> PublicKeyBytes {
37        PublicKeyBytes::from(self.secret.public_key())
38    }
39
40    // Return the salt contained by this handshake
41    pub fn salt(&self) -> &Salt {
42        &self.salt
43    }
44
45    /// Derives a shared secret using another key exchange's public key and salt
46    pub fn derive_shared_secret(
47        &self,
48        public_key: PublicKeyBytes,
49        salt: Salt,
50    ) -> io::Result<SecretKey32> {
51        // Decode the public key of the other side
52        let decoded_public_key = PublicKey::try_from(public_key)?;
53
54        // Produce a salt that is consistent with what the other side will do
55        let shared_salt = self.salt ^ salt;
56
57        // Acquire the shared secret
58        let shared_secret = self.secret.diffie_hellman(&decoded_public_key);
59
60        // Extract entropy from the shared secret for use in producing a key
61        let hkdf = shared_secret.extract::<Sha256>(Some(shared_salt.as_ref()));
62
63        // Derive a shared key (32 bytes)
64        let mut shared_key = [0u8; 32];
65        match hkdf.expand(&[], &mut shared_key) {
66            Ok(_) => Ok(SecretKey32::from(shared_key)),
67            Err(x) => Err(io::Error::new(io::ErrorKind::InvalidData, x.to_string())),
68        }
69    }
70}
distant_net/common/transport/framed/exchange.rs

distant_net/common/transport/framed/
exchange.rs
